FranceProjet de loi Résilience des Infrastructures Critiques et Cybersécurité, Incident Notification (NIS2)
Article 17, texte adopté n° 78 (2024-2025), Sénat, 12 mars 2025 (notification des incidents)
Before the second chamber, dated , as of .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
Where it has got to
The text described here is Texte adopté n° 78 (2024-2025), adopted by the Sénat in first reading, , published .
Locally, this stage is special committee review (commission spéciale) at the Assemblée nationale, concluded , before debate in public session (séance publique).
The stage above is recorded at www.assemblee-nationale.fr.
The Assemblée nationale's special committee (commission spéciale) deposited its text, n° 1779-A0, on ; where that text differs from the Sénat's first-reading text for the provisions described here, the summary and the requirements say so.
On the Assemblée nationale's conference of presidents withdrew the bill from the sittings of 7 and , and as of the Assemblée nationale's dossier lists no sitting in séance publique (floor session), no second reading and no promulgation.
What it requires
- As drafted, this would bind the same essential and important entities as this jurisdiction's companion risk-management row, for the reason given there.
- In the text the Sénat adopted, notify ANSSI without undue delay of any incident with an important impact on the provision of your services (one causing or liable to cause a severe operational disruption or financial loss for you, or considerable material, physical or non-material damage to another person), on a graduated clock: an initial notification within 24 hours of becoming aware of it, an intermediate notification within 72 hours of becoming aware of it updating the initial one and giving an initial assessment of severity and impact, a report on ANSSI's request, and a final report within one month of the intermediate notification, or, where the incident is not yet handled by then, a progress report within one month of the intermediate notification and a final report within one month of the incident being handled (Article 17).
- In the text the Assemblée nationale's special committee deposited (n° 1779-A0), the initial notification within 24 hours, the intermediate notification within 72 hours and the final report within one month would be the same, but an incident would count as important only where it caused or is liable to cause a severe operational disruption or significant financial losses for you, or considerable material, physical or non-material damage to another person.
- In that committee text, where appropriate, notify the recipients of your services without undue delay of an important incident with a direct impact on them and of the measures or corrections they can apply against a critical vulnerability, and also inform them of the vulnerability itself, except for information whose disclosure would harm the interests of defense and national security.
- Where you are a qualified trust-service provider (Article 8(4)) or a trust-service provider (Article 9(3)), send the intermediate notification within 24 hours rather than 72 for an incident affecting your trust services.
These lines are LexLint's reading of the law's text. Also read by: Agence nationale de la sécurité des systèmes d'information (ANSSI) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 37 of the text the Sénat adopted frames the penalty as an amende administrative (administrative fine) imposed by the sanctions commission; no provision of that text makes the infringement itself a criminal offence.
Penalty structure
Article 37.I.1° of the text the Sénat adopted in first reading sets the maximum administrative fine for an essential entity's infringement at the greater of EUR 10,000,000 or 2 percent of worldwide annual turnover, and 37.I.2° sets an important entity's maximum at the greater of EUR 7,000,000 or 1.4 percent, mirroring NIS2 Article 34(4) and (5).
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The Agence nationale de la sécurité des systèmes d'information (ANSSI), as the national network and information system security authority, which would notify a controlled entity of the grievances found against it and refer the matter to the commission des sanctions (sanctions commission) that Code de la défense Article L. 1332-15 establishes.
Settledness
- As of
- Guidance link
- https://cyber.gouv.fr/
- Guidance body
- Agence nationale de la sécurité des systèmes d'information (ANSSI)
- Open questions
- Will the Assemblée nationale put the bill back on the agenda of its public sittings after its conference of presidents withdrew it on from the sittings of 7 and , and will the floor text, and any second Sénat reading, preserve the Article 14, Article 17 and Article 37 provisions of the special committee's text (n° 1779-A0)?
What this law does
Article 17 of the text the Sénat adopted in first reading would require the same essential and important entities Article 14 covers to notify ANSSI without undue delay of any incident with an important impact on the provision of their services, on a graduated clock: an initial notification within 24 hours of becoming aware of it, an intermediate notification within 72 hours updating the initial one and giving an initial assessment of severity and impact, a report on ANSSI's request, and a final report within one month (or, for an incident still being handled, a progress report at one month followed by a final report within one month of resolution), transposing NIS2 Article 23.
A qualified trust-service provider (Article 8(4)) and a trust-service provider (Article 9(3)) send the intermediate notification within 24 hours rather than 72 for an incident affecting their trust services. ANSSI in turn responds within 24 hours of the initial notification where possible. On the Assemblée nationale's conference of presidents withdrew the bill from the sittings of 7 and .
As of the Assemblée nationale's dossier ends with the special committee's text and lists no sitting in séance publique (floor session). The text that special committee deposited on (n° 1779-A0) would keep the same graduated clock for Article 17, an initial notification within 24 hours and an intermediate notification within 72 hours of becoming aware of an important incident.
In that committee text an incident would be important where it caused or is liable to cause a severe operational disruption or significant financial losses for the person concerned.
That committee text would also oblige essential and important entities, where appropriate, to notify the recipients of their services without undue delay of an important incident with a direct impact on them and of the measures or corrections they can apply against a critical vulnerability, and to inform them of the vulnerability itself.
Article 37 of that committee text would keep the same ceilings for the administrative fine, up to EUR 10,000,000 or 2 percent of worldwide annual turnover for an essential entity and up to EUR 7,000,000 or 1.4 percent for an important entity, whichever is higher.
When LexLint raises it
When your app profile says your app operates a social platform or runs an essential service.
Back to the example · Lint your app
Page updated .